Cloud Firestore security rules “if exists” not working

Question

I have a simple chat app on Cloud Firestore with the following security rule to only allow users the ability to send messages in a chat room if they "joined" the room in the app itself:

match /hangouts/{hangout}/messages/{message} {
        allow create, write, update, read: if exists(/databases/$(database)/documents/users/{userId}/hangout/{hangout});
    }

If the user has a hangoutID in their collection on Firestore then they should be allowed to send the message to that hangoutID. However, I'm still getting error messages:

Write at hangouts/ChIJPRVm2R7H54kRKLP2ttsuUko/messages/17225E70-B708-4033-AE5A-D0CBBD1BC69F failed: Missing or insufficient permissions.

I also have 2 other rules related to hangouts. Is it possible these are interfering?

match /hangouts/{hangout} {
    allow read, update, write, create: if request.auth.uid != null;
}

match /hangouts/{hangout}/members/{userId} {
    allow read: if request.auth.uid != null;
  allow create, update, write, delete: if request.auth.uid == userId;
}

The first one is so people can create and see chatroom hangouts, and the second one is to allow people to join them.

What am I doing wrong? I'm a little new to this concept.

Thanks!!

Doug Stevenson Doug Stevenson · Accepted Answer · 2019-05-09T23:54:24

It looks like you're not doing variable substitution correctly for document paths. In the match part, you use {curly braces} to indicate where the wildcards are, but in the path expression, you use the name of the wildcard like $(this).

/databases/$(database)/documents/users/$(userId)/hangout/$(hangout)

Cloud Firestore security rules “if exists” not working

1 Answers